From fc18f36c4ab94399366ca2f2007b3692559a6f23 Mon Sep 17 00:00:00 2001 From: Mariusz Felisiak Date: Fri, 21 Jan 2022 07:50:03 +0100 Subject: Fixed CVE-2022-23833 -- Fixed DoS possiblity in file uploads. Thanks Alan Ryan for the report and initial patch. --- django/http/multipartparser.py | 2 ++ 1 file changed, 2 insertions(+) (limited to 'django/http') diff --git a/django/http/multipartparser.py b/django/http/multipartparser.py index c3cb90e639..ef0b339d1b 100644 --- a/django/http/multipartparser.py +++ b/django/http/multipartparser.py @@ -248,6 +248,8 @@ class MultiPartParser: remaining = len(stripped_chunk) % 4 while remaining != 0: over_chunk = field_stream.read(4 - remaining) + if not over_chunk: + break stripped_chunk += b"".join(over_chunk.split()) remaining = len(stripped_chunk) % 4 -- cgit v1.3